Identity & Access Management Engineer

Pretium Enterprise Services • Scottsdale, AZ

22h • Hybrid

About The Position

Pretium Enterprise Services (PES) is seeking an Identity and Access Management Engineer Lead to design, build, and operate identity security capabilities across the operating companies it supports. This is a hands-on individual contributor role with no direct reports. The engineer will own technical delivery of the identity roadmap, initially strengthening existing access controls and implementing Identity Governance and Administration (IGA). Responsibilities include configuring platforms, developing integrations and automation, resolving production issues, and establishing reusable standards across Microsoft, AWS, and business applications.

The position is hybrid, with three days a week in the Scottsdale, Arizona office preferred. Dallas, Texas; Charlotte, North Carolina; and California are also considered locations. The role works with the Director of Cybersecurity, cloud and AI engineers, HR, application and business owners, security operations, implementation partners, and operating-company teams.

Requirements

• Senior-level IAM engineering experience owning enterprise identity solutions from design through production support, with the ability to independently assess problems, implement controls, and verify outcomes.
• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Computer Engineering, Software Engineering, or Information Technology.
• Hands-on delivery of an enterprise IGA implementation through go-live and operational support, including connectors, lifecycle workflows, reconciliation, and access reviews.
• Strong Microsoft Entra ID and Active Directory engineering skills, including federation, Conditional Access, privileged identity management, and hybrid identity troubleshooting.
• Production experience with AWS workforce federation, IAM Identity Center, and Azure access controls.
• Ability to assess effective access across directory roles, application entitlements, and cloud permissions.
• Ability to implement and troubleshoot SAML, OpenID Connect, OAuth, and SCIM integrations, including authentication, authorization, and provisioning failures.
• Strong PowerShell or Python skills and REST API experience, such as Microsoft Graph.
• Ability to build tested, version-controlled automation with error handling, monitoring, and secure credential handling.
• Experience translating business access requirements into maintainable least-privilege controls, privileged-access workflows, role-based access, and identity lifecycle processes.
• Ability to explain risk, secure cooperation, and drive remediation across independent teams.
• Strong documentation, troubleshooting, and technical mentoring skills.

Nice To Haves

• Experience in shared-services or multi-tenant environments.
• Experience with Workday or ADP integrations.
• Experience with Linx, SailPoint, or Saviynt.
• Experience with dedicated PAM solutions.
• Experience with access governance for Palantir, Snowflake, or Salesforce.
• Relevant certifications.

Responsibilities

• Assess identity environments across operating companies, prioritize risks and integration dependencies, and deliver a phased IAM roadmap with the Director of Cybersecurity.
• Own hands-on IGA implementation and ongoing operations, including platform configuration, application onboarding, connectors, reconciliation, access requests, and certification campaigns.
• Integrate HR systems, directories, and applications to automate joiner, mover, and leaver processes for employees and contractors.
• Resolve identity-data quality issues and verify access removal across connected systems.
• Engineer Microsoft Entra ID and hybrid Active Directory controls, including SSO, federation, MFA, Conditional Access, and directory synchronization; secure guest and cross-tenant access where required.
• Design and implement workforce access across AWS accounts and Azure environments, including federation, AWS IAM Identity Center permission sets, and privileged role assignments, in partnership with cloud engineering on resource-level permissions.
• Establish privileged-access controls, including time-limited elevation, approvals, administrative account separation, and tested emergency access.
• Reduce unnecessary standing privileges and remediate orphaned or excessive access.
• Work with HR, application, and business owners to define role-based access, birthright rules, entitlement ownership, and segregation of duties; translate approved decisions into enforceable workflows and access reviews.
• Build and troubleshoot application integrations using SAML, OpenID Connect, OAuth, and SCIM; develop API-based connectors and automation when native integrations do not meet requirements.
• Establish ownership, access-review, and credential-lifecycle standards for service accounts, application identities, RPA bots, and AI agents, partnering with cloud and AI engineers on implementation.
• Own identity service reliability, including provisioning-failure monitoring, root-cause resolution, change testing, rollback, and recovery procedures.
• Partner with security operations on identity logging and incident containment.
• Provide technical direction to implementation partners, validate deliverables, and ensure documentation and knowledge transfer.
• Mentor and cross-train engineers to provide operational backup without direct management responsibility.
• Track provisioning reliability, access-removal timeliness, privileged-access exposure, and review completion; produce audit evidence and drive remediation with application and operating-company owners.

Benefits

• 401(k) plan with an employer match.
• Health, dental, vision, and life insurance.
• Paid Time Off (PTO).
• 11 firm holidays.
• Hybrid office/work-from-home arrangement.
• Annual year-end bonus eligibility.
• Collegial, entrepreneurial work environment committed to team members’ personal and professional growth.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior